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ABSTRACT 


Several  conceptual  questions  dealing  with  warning  system  struc¬ 
tures  are  discussed,  including  techniques  for  correlating  the  outputs 
of  multiple  warning  systems  that  compose  a  warning  complex.  The  dis¬ 
cussions  are  illustrated  by  a  number  of  elementary  analyses,  dealinr 
with  warning  probabilities,  false-warning  rates,  a 'd  warning  times. 

The  mathematical  calculations  pertain  to  hypothetical  automatic  event 
detectors  and  automatic  decision  systems  employing  the  outputs  of  such 
detectors.  It  is  demonstrated  that  the  use  of  multiple  sensing  ele¬ 
ments  in  a  warning  system  implies  a  need  for  proper  association  of  re¬ 
dundantly  detected  signatures  of  real  events  and  false  signatures . 

The  consequences  of  imperfect  association  are  f alse-warning  rates 
that  Cun  exceed  by  a  considerable  factor  the  rates  that  would  be  ob¬ 
tained  assuming  perfect  association  and  when  undesired  warnings  are 
generated  in  response  to  nonbelligerent  activities. 
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I .  INTRODUCTION 


The  term  "warning  system"  is  used  in  the  present  context  to  refer 
to  the  apparatus  and  operational  procedures  used  to  provide  the  National 
Command  Authority  (NCA)  with  knowledge  of  an  immediately  impending  at¬ 
tack  against  the  United  States  and  its  strategic  offensive  and  defen¬ 
sive  forces,  e  .g . ,  by  detection  of  a  large  number  of  Intercontinental 
Ballistic  Missiles  (ICBM)  launched  toward  the  continental  United  States. 
This  aspect  of  the  overall  strategic  forecasting  process  is  usually 
designated  tactical  warning,  as  distinct  from  strategic  warning,  which 
alerts  the  NCA  that  such  an  attack  may  occur  in  the  near  cuture . 

The  fundamental  differences  between  tactical  and  strategic  warning 
are  quite  important.  Strategic  warning  data  are  generally  prepared  for 
a  longer  time  range  and  can,  within  the  limits  of  current  policy,  only 
influence  the  state  of  preparedness  of  the  nation  for  general  war.  More 
important,  strategic  warning  systems  can  be  exercised  in  terms  of  poten¬ 
tial  conflict  at  levels  lower  than  general  war;  the  responsiveness  and 
accuracy  of  the  predictions  provided  by  the  strategic  warning  apparatus 
can  thus  be  evaluated  in  a  variety  of  situations  less  critical  than 
general  war.  Over  a  period  of  time,  therefore,  a  good  strategic  warn¬ 
ing  capability  can,  in  principle,  acquire  an  image  of  high  credibility 
in  the  eyes  of  the  NCA,  by  providing  timely  and  accurate  forecasts  of 
impending  crises . 

Tac* ical  warning  systems  cannot  be  evaluated  in  the  same  way;  they 
can  only  be  subjected  to  limited-scale  tests,  from  which  their  perform¬ 
ance  must  be  inferred,  through  careful  analysis  of  the  test  results  and 
thor'uqh  understanding  of  the  phenomenology  that  influences  their  oper¬ 
ation.  Such  tests  are  provided  by  tests  of  missile  forces  by  other  na¬ 
tions,  it.  addition  t  planned  trials  and  evaluations  by  the  United  State 


Or.ce  a  warning  message  from  a  tactical  warning  system  has  been  re¬ 
ceived,  different  responses  can  be  initiated:  the  commitment  of  U.S. 
retaliatory  forces,  the  delegation  of  authority  to  use  nuclear  weapons 
to  defensive  forces,  and  other  major  military  and  civilian  actions  by 
the  nation . 

The  avdixauiliry  of  a  credible  warning  capability  could  permit 
substantial  savings  in  the  cost  of  operating  the  strategic  bomber  fleet 
by  minimizing  the  need  for  airborne  alert  missions  .  Other  potential 
benefits  have  apparently  not  been  evaluated;  in  general,  the  value  of 
increased  quality  of  warning  data  and  increased  warning  time  to  the 
RCA  is  not  known.  One  possibility  is  the  enabling  of  an  option  for 
launch- on-warning  (LOW),  whereby  knowledge  of  an  attack  already  in 
being  could  be  used  to  launch  retaliatory  weapons.  Two  kinds  of  cred¬ 
ibility  for  tactical  warning  are  required,  however,  for  the  benefits 
of  LOW  to  be  realized.  First,  the  system  or  systems  composing  a  tacti¬ 
cal  warning  complex  must  provide  some  degree  of  certainty  of  detecting 
the  onset  of  an  attack  and  near  certain  identification  of  the  attacker; 
S'  cond ,  the  likelihood  of  declaring  that  an  attack  has  begun,  when 
such  is  not  the  case,  must  be  made  vanishingly  small.  It  is  well  known 
that  these  two  requirements  work  against  each  other. 

The  tactical  warning  situation  is  further  complicated  by  the  exis* 
ence  of  a  variety  of  strategic  threats,  other  than  vhe  JCBM  already 
mentioned.  The  Submarine-Launched  Ballistic  Missile  (SLBM)  threat  is 
one  example:  the  relatively  short  flight  time  for  such  weapons  re¬ 
duces  the  time  available  for  warning,  and  the  fact  that  the  missile  is 
launched  from  a  mobile  platform  in  the  open  seas  makes  more  difficult 
the  task  of  identifying  the  attacking  nation. 

The  prognosis  for  realizing  a  nearly  ideal  tactical  warning  capa- 
bil'ty  is  not  completely  bleak,  despite  the  complications  and  conflict - 
inu  i  'ouirementt  noted  above.  Realization  is  dependent  on  an  under- 
r  undii  :  of  how  tactical  warning  system  outputs  are  to  be  used;  it  is 
‘lx-  purpose  of  this  paper  to  indicate  some  of  the  statistical  and  struc 
‘  :rul  concept::  that  are  involved  in  achieving  such  understanding .  The 
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substantive  text  begins  v.  .h  a  delineation  of  design  objectives  for 
warning,  and  then  considers  the  conceptual  problems  of  correlating  the 
outputs  of  multiple  warning  systems.  These  discussions  are  followed 
by  several  rudimentary  mathematical  analyses  pertaining  to  the  per¬ 
formance  of  (hypothetical)  automatic  event  detectors  and  decision  ele¬ 
ments  that  could  constitute  a  warning  capability.  The  paper  is  in¬ 
tended  to  be  heuristic;  references  to  specific  techniques  for  acquiring 
and  interpreting  tactical  warning  data  have  been  scrupulously  avoided. 
This  approach  permits  the  use  of  relatively  elementary  statistical 
models  for  the  purpose  of  illustrating  concepts  that  have  arisen  from 
studies  of  real  systems.  Those  participating  in  the  design  and  eval¬ 
uation  cf  real  systems  must,  of  course,  ascertain  the  real  statistical 
descriptions . 
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II .  THE  PROBLEM 


A.  PRINCIPAL  OBJECTIVES 

Several  of  the  principal  objectives  in  synthesizing  a  ta 
warning  capability  are  discussed  in  the  following  paragraphs. 

1.  Adequate  Spatial  Coverage  means  that  all  points  on  t 
of  ^he  earth,  all  regions  of  the  atmosphere,  and  all  regions 
from  which  an  attack  could  be  launched  should  be-  kept  under  s 
lance  for  warning  purposes.  The  qualif ication  "adequate"  int 
with  the  rf action  time  objective  noted  below  in  point  5*  For 
it.  may  be  unnecessary  to  maintain  surveillance  of  launch  pein 
bomber  attacks ,  because  the  time  available  for  dealing  with  si 
attack  (wnon  detected  several  hundred  miles  from  the  United  S' 
long  compared  with  the  time  available  for  dealing  with  other  i 
aita.'ks.  Thus,  for  bomber  attack  warning,  the  surveillance  rt 
c  Id  be  strongly  curtailed,  relative  to  the  surveillance  reg: 
quiivd  for  timely  detection  of  other  kinds  of  attacks  . 

2.  Adequate  Temporal  Coverage  simply  means  that  the  peri 
the  i.-!al  tactical  warning  capability  should  be  insensitive 

varving  phenomena  that  may  influence  the  performance  of  indivi 
ten  •.foments. 

High  Probability  of  Attack  Detection  is  influenced  by 
tent  t  which  objectives  1  and  2  a^e  achieved,  but  it  a  Is  b  inv 
m  olitv  of  t  he  detection  equipment  used  and  the  means  employed 
■  tv:: slating  ‘.elections  int  warning  messages.  The  qualif icoti 
:.<-e  :  nut  mean  arbitrarily  close  to  unity,  because  the  warning 


»s  .  for  example,  that  greater  deterrence  woul'  be  ach 
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increasing  the  probability  of  attack  detection  from ;  say.  0,95  to  0.9S. 
In  either  case,  the  odds  against  achieving  an  attack  without  tactical 
warning  to  the  United  States  deterrent  complex  are  formidable.  A  de¬ 
cision  to  attack  the  United  States  in  the  race  of  such  odds  would  most 
likely  still  be  made  even  if  the  attack  warning  probability  were  unity. 

4.  High  Confidence  in  Attacker  Designation  means  that  in  addition 
*-o  declaring  with  high  confidence  that  the  United  States  is  under  at¬ 
tack,  the  warning  capability  must  provide  the  command -and -control  struc¬ 
ture  with  the  identity  (or  identities)  of  the  attacking  nation  (or  na¬ 
tions).  This  is  essential  if  the  doctrine  of  retaliation  is  to  be  im¬ 
plemented.  The  objective  also  clearly  involves  objectives  1,  2,  and  3. 
In  many  instances,,  designation  of  the  locations  of  launch  points  is 
sufficient  for  this  purpose,  and  such  data  would  be  a  natural  output 
of  several  types  of  warning  systems.  It  should  be  noted,  however,  that 
it  is  possible  tc  postulate  irrational  threats  for  which  no  practical 
solution  to  the  attacker  designation  problem  has  been  delineated.  This 
point  evokes  the  notion  of  an  interaction  between  tactical  warning  and 
defense;  if  the  nature  of  an  attack  is  such  that  a  high-confidence  des¬ 
ignation  of  the  attacking  nation  is  impossible,  then  retaliation  against 
such  a  tnreat  may  be  ruled  out ,  the  deterrent  value  of  retaliation  is 
nullified,  and  defense  is  the  only  available  option. 

5.  Short  Reaction  Time  can  equivalently  be  called  maximum  ad¬ 
vance  notice.  It  will  be  seen  that  the  reaction  time  associated  with 
a  tactical  warning  system  depends  on  the  kinds  and  quality  of  data  that 
it  provides  and  on  the  character  of  the  threat  that  is  being  detected; 
clearly  the  need  for  advance  notice  depends  on  the  use  that  will  be 
made  of  the  warning  data.  There  is  obviously  an  upper  .limit  to  the  ad¬ 
vance  notice  available,  ranging  from  several  hours  for  bomber  attacks 
to  several  minutes  for  attacks  by  submarine-launched  ballistic  missiles 
(SLBM).  For  certain  future  threat  types,  the  potentially  available  ad¬ 
vance  notice  cannot  be  predetermined,  but  it  may  be  greater  than  the 
notice  available  for  ICBM  attacks  or  less  than  that  available  for  SLBM 
attacks ,  depending  on  the  capabilities  of  the  warning  system  and  the 
o  f ini t. ion  of  tactical  warning.  For  these  threats,  the  distinction 
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between  strategic  warning  and  tactical  warning  becomes  vague,  which 
is  not  to  say  that  achievement  of  a  technical  capability  for  inferring 
the  existence  of  a  threat  situation  is  unimportant. 

Reaction  time  requirements  are  not  easy  to  specify,  since  they 
depend  on  the  extent  to  which  prior  alerting  by  means  of  strategic 
warning  capabilities  can  be  achieved  and  the  use  that  will  be  made  of 
the  tactical  warning  data  by  the  NCA. 

6.  Low  False -Warning  Rate  simply  means  that  the  rate  (e.g.,  num¬ 
ber  of  times  per  year  or  decade)  at  which  a  system  generates  warning 
messages  when  an  attack  is  not  occurring  shall  be  tolerably  low,  the 
tolerance  level  being  established  by  the  implications  of  the  response 
to  the  message.  This  suggests  that  warning  messages  may  be  categorized 
according  to  the  level  of  the  presumed  threat;  a  low-level  warning  mes¬ 
sage  would  generally  lead  to  a  low-level  response,  e.g.,  alerting  of 
strategic  forces.  An  intermediate-level  warning  message  would  pre¬ 
sumably  lead  to  such  actions  as  scrambling  of  strategic  bomber  forces; 
only  the  highest  level  warning  message  would  trigger  a  LOW  retaliation. 
Given  a  spectrum  cf  possible  responses  to  warning  messages,  there  will 
be  a  spectrum  of  tolerable  false-warning  rates,  determined  somewhat 
subjectively  by  the  tolerable  cost  of  false  responses. 

The  false-warning  rate  specification  question  is  further  compli¬ 
cated  when  deployment  of  an  active  defense  is  undertaken.  The  avail¬ 
ability  of  defense  provides  additional  options  in  the  response  to  warn¬ 
ing  messages  and,  generally  speaking,  should  permit  substantial  reduc¬ 
tions  in  higher  level  false-warning  rates,  because  the  thresholds  for 
generating  warning  messages  that  lead  to  higher  level  responses  can 
be  increased,  by  virtue  of  the  defense  option. 

B.  SECONDARY  OBJECTIVES 

Realization  of  the  preceding  objectives  implies  the  existence  of 
a  useful  warning  capability;  the  following  objectives  support  the  need 
to  sustain  that  utility. 
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1.  Low  Susceptibility  to  Sensor-Oriented  Interference  refers  to 
two  main  occurrences :  the  credibility  of  warning  messages  can  be  de¬ 
graded  by  spoofing  (generation  of  false  signatures  that  are  detected 
by  a  warning  system  and  interpreted  as  threatening  events),  and  attack 
activity  signatures  can  be  masked  by  jamming.  Just  as  a  highly  cred¬ 
ible  warning  capability  is  strongly  leveraged,  so  is  a  capability  for 
degrading  its  utility,  although  deliberate  attempts  at  such  degrada¬ 
tion  can  in  themselves  be  regarded  as  strategic  warning  indicators.  A 
related  secondary  objective  is  achievement  of  insensitivity  to  other 
measures  intended  to  degrade  warning  capabilities  (e.g.,  jamming  of 
communication  links  or  destruction  of  processing  facilities).  This  is 
not  cited  as  a  primary  objective,  because  it  is  common  to  all  elements 
of  the  command-and-control  complex  and  is  dealt  with  by  prudent  design 
practice,  including  hardening  and  redundancy. 

2.  Growth  Potential  or  Residual  Capacity  for  dealing  with  future 
threats  is  important,  since  the  dimensions  of  possible  threats  are 
continually  increasing  with  innovations  and  advances  in  offensive  weapon 
technology.  Indeed,  it  can  be  argued  that  the  development  of  new  enemy 
offensive  weapon  systems  may  be  motivated  in  part  by  an  effort  to  cir¬ 
cumvent  the  leverage  exerted  by  an  effective  warning  system. 

Implicit  in  all  of  these  objectives  is  a  fundamental  requirement 
that  the  warning  system  be  capable  of  determining  not  only  that  an 
attack  is  occurring,  but  that  the  attack  is  indeed  directed  toward  the 
United  States.  Systems  that  indicate  only  that  an  attack  is  being 
launched  (without  specifying  the  object  of  the  attack)  can  provide 
valuable  alerting  and  corroborative  functions,  but  they  do  not  consti¬ 
tute  solutions  t^  the  warning  problem. 

C.  THE  WARNING  COMPLEX 

Achievement  of  these  objectives  seems  to  imply  the  development 
and  deployment  of  several  warning  systems  that  are  different  in  kind 
as  well  as  in  coverage;  collectively,  we  refer  to  these  systems  as  a 
warning  complex.  We  shall  be  concerned  in  what  follows  with  the  sta¬ 
tistical  characterization  of  individual  warning  system  outputs,  the 
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possible  structures  of  warning  complexes,  and  the  statistical  charac¬ 
terization  of  the  outputs  of  a  warning  complex.  The  emphasis  will  be 
on  systems  designed  to  detect  ICBM  attacks  against  the  United  States, 
centering  on  false-warning  statistics  and  attack-detection  (true  warn¬ 
ing)  probabilities:  some  consideration  will  also  be  given  to  response¬ 
time  characteristics  of  warning  complexes.  No  consideration  will  be 
given  to  the  questions  of  spatial  and  temporal  coverage,  although  some 
perhaps  unappreciated  implications  of  redundant  coverage  will  be  dis¬ 
cussed.  Finally,  we  will  do  no  more  than  allude  to  the  important  prob¬ 
lem  of  providing  communication  links  between  the  sensing  elements  of 
the  warning  systems,  the  data  processing  and  interpretation  elements 
of  the  warning  complex,  and  the  NCA. 
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III.  WARNING  SYSTEMS  STRUCTURES  AND  SPECIFICATIONS 

A.  THE  ELEMENTARY  STRUCTURE 

Figure  1  depicts  an  elementary  warning  system  structure.  The  sys¬ 
tem  is  equipped  with  an  array  of  sensors;  each  sensor  is  designed  to 
detect  some  physical  manifestation  of  an  attack  or  one  or  more  of  the 
elements  of  an  attack.  Multiple  sensors  are  generally  required,  so  as 
to  achieve  adequate  spatial  coverage,  increased  reliability,  increased 
probability  of  detection,  or  additional  data  for  subsequent  descrip¬ 
tion  of  the  attack. 


WARNING 
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DATA 
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WARNING  DATA 


FIGURE  I.  Elementary  Warning  Sy*tc.m  Structure 


The  attack  or  element (s )  of  an  attack  that  are  to  be  detected  will 
be  referred  to  as  an  event,  and  the  response  of  a  sensor  to  an  event 
will  be  referred  to  as  its  signature.  In  addition  to  providing  a  basis 
for  detecting  the  event,  the  signature  will  in  general  depend  on  the 
character  of  the  event  (e.g.,  number  of  elements  in  the  attack,  point 
of  origin).  In  general,  the  signature  will  not  explicitly  reveal  the 
information  that  is  of  interest  to  the  warning  system  user. 

The  spatial  and  temporal  coverage  provided  by  the  individual  sen¬ 
sors  may  overlap  in  various  ways.  Two  or  more  sensors  in  the  array 
may  respond  simultaneously  to  an  event,  or  in  some  time  sequence.  The 
order  and  time  spacing  of  sequential  responses  may  not  be  known  in  ad¬ 
vance,  in  which  case  the  time  sequence  itself  provides  information  rel¬ 
evant  to  the  event  description.  The  spatial  coverage  provided  by  a 
sensor  may  be  a  stochastic  process. 

It  will  be  assumed  that  the  sensors  in  the  array  are  functionally 
identical,  in  the  sense  that  they  are  designed  to  exploit  a  single  com¬ 
mon  class  of  physical  phenomena,  producing  real  or  false  signatures 
under  similar  conditions . 

The  outputs  of  the  sensors  are  delivered  (read  out)  by  some  means 
to  a  data-processing  facility,  which  renders  detection  decisions,  ex¬ 
tracts  descriptions  of  detected  events,  and  renders  decisions  to  trans¬ 
mit  warning  messages.  Of  particular  interest  in  the  descriptions  that 
are  inferred  are  data  pertaining  to  the  size  of  the  attack,  its  point 
of  origin,  and  parameters  for  estimating  the  potential  target  of  the 
attack.  The  decision  to  transmit  a  warning  message  is  based  on  the 
attack-size  estimate  and  an  inference  from  the  event-description  param¬ 
eters  that  the  United  States  is  the  potential  target. 

An  important  function  of  the  data-processing  facility  is  aggrega- 
ti  n,  which  is  the  process  of  associating  multiple  signatures  from  a 
sinule  event  and  compiling  a  composite  multiple-sensor  signature  (e.g., 
.no  including  the  time-sequence /sensor-number  data  mentioned  previously). 
The  association  operation  is  essential  to  prevent  multiple  signature 
detections  (from  a  single  event)  from  being  interpreted  as  multiple 
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events .  The  composite  signature  may  lead  to  a  more  precise  description 
of  the  event  and  may  contain  data  relevant  to  the  event  description 
th.it  are  not  available  from  a  single  signature. 

Finally,  the  warning  message  and  aggregated  event  descriptions 
are  transmitted  to  the  user  via  a  communications  link.  It  is  assumed 
that  the  link  is  perfect,  although  certain  losses  can  be  accounted  for 
by  modifying  the  parameters  characterizing  the  individual  warning  sys¬ 
tems  • 

Many  ramifications  of  the  foregoing  structure  can  be  described; 
a  few  will  be  mentioned  here.  The  system  may  be  equipped  with  a  sec¬ 
ondary  sensor  array,  whose  function  may  be  to  ascertain  the  operational 
status  of  the  primary  sensors  (e.g.,  coverage)  or  to  provide  data  for 
modification  of  the  signature-detection  algorithms  used  in  the  data- 
processing  facility. 

The  read-out  process  may  be  intermittent  (instead  of  continuous, 
as  was  implied  above).  For  example,  each  sensor  may  be  equipped  with 
a  predetection  decision  element  to  limit  read-out  transmissions  to 
those  sensed  signal  sequences  that  are  most  likely  to  contain  signa¬ 
tures  (autonomous  reporting).  Alternatively,  the  sensors  may  contain 
storage  elements;  read-out  can  then  be  accomplished  on  interrogation 
from  the  data-processing  facility  (command  reporting).  Such  interroga¬ 
tions  may  be  transmitted  to  the  sensors  cyclically,  on  the  basis  of 
signatures  received  from  other  sensors  in  the  array,  or  on  the  basis 
of  data  from  other  warning  systems. 

In  addition  to  interrogation,  the  data-processing  facility  may  be 
equipped  to  command  parameter  changes  in  the  individual  sensors.  The 
read-out  process  may  be  accomplished  through  intermediate  collection- 
and-relay  certers,  to  facilitate  reception  of  data  from  remote  sensors. 

These  ramifications  are  generally  undertaken  to  ease  the  system 
design  (even  though  they  may  appear  to  increase  its  complexity)  or  to 
improve  system  performance.  Very  little  is  known  egarding  the  dynam¬ 
ically  optimum  control  of  such  a  structure. 


B.  COMPOSITE  STRUCTURES 


Some  rudimentary  ideas  will  be  presented  here  for  combining  warn¬ 
ing  systems  into  a  warning  complex,  in  order  to  establish  a  conceptual 
framework  for  the  analytical  considerations  of  Section  V.  As  was  noted 
in  Section  II,  the  use  of  a  number  of  diverse  warning  systems  seems  nec¬ 
essary  in  order  to  meet  the  requirements  of  spatial  and  temporal  cover¬ 
age,  low  false-warning  rate,  high  probability  of  generating  a  warning 
message  when  an  attack  against  the  United  States  is  in  progress,  and 
so  forth.  Implicit  in  these  requirements  is  the  ability  to  monitor 
activity  in  all  threat  classes  that  the  user  deems  to  be  significant. 

The  functions  of  a  warning  system  are  to  detect  the  occurrence  of 
events  that  are  characteristic  of  one  or  more  threat  classes  and,  by 
analyzing  their  signatures,  to  determine  whether  a  threat  indeed  exists. 
Because  of  the  diversity  of  threat  classes  (ICBM,  SLBM,  manned  bombers, 
fractional  orbital  bombardment  system  (FOBS),  and  others)  and  because 
each  threat  class  presents  different  kinds  of  signatures  for  detection 
and  analysis,  the  requirement  to  cover  all  significant  threat  classes 
additionally  implies  the  use  of  multiple  and  diverse  warning  systems. 

The  general  scheme  for  a  warning  complex  is  that  each  warning 
system  transmits  its  warning  messages  and  threat  descriptions  tc  a 
central  data -processing  facility.  For  at  least  two  reasons,  the  final 
responsibility  for  determining  the  existence  and  character  of  an  attack 
against  the  United  States  rests  with  this  facility.  First,  a  not  un¬ 
reasonable  attack  plan  could  employ  a  wide  variety  of  threat  classes 
with  a  relatively  low  level  of  activity  in  each  class.  Thus,  while 
a  warning  system  monitoring  activity  within  a  single  threat  class 
might  ascertain  the  existence  of  a  threat,  it  would  be  incapable  of 
assessing  the  significance  of  the  totality  of  activity  in  all  threat 
classes.  Second,  the  need  for  high  credibility  in  the  warning  messages 
that  are  delivered  to  the  NCA  necessitates  a  capability  for  verifica¬ 
tion,  at  least  for  the  mort  important  threat  classes. 

The  functions  of  the  central  data-processing  facility  are  there¬ 
fore  twofold:  to  integrate  messages  and  descriptions  from  multiple 
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warning  systems  pertaining  to  each  threat  class  (thereby  verifying  the 
existence  of  threats  and  obtaining  more  precise  information  on  them) 
and  to  generate  for  the  NCA  a  composite  description  oi  the  total  at¬ 
tack,  including  all  threat  classes  that  are  monitored  by  the  individual 
systems.  The  following  are  some  of  the  complications  that  must  be 
dealt  with  in  performing  these  functions : 

1.  Different  warning  systems  that  monitor  activity  within  a 
single  threat  class  may  provide  event  detections  and  threat 
descriptions  for  that  class  at  grossly  different  times. 

2.  The  occurrences  of  false-event  detections  by  different  sys¬ 
tems  may  not  be  statistically  independent. 

i.  Different  systems  that  monitor  activity  within  a  single  threat 
class  may  provide  different  kinds  of  descriptions  of  events 
that  arc  detected. 

4.  Discrepancies  can  exist  between  the  event  detections  and 
descriptions  provided  by  different  systems  that  monitor 
activity  within  a  single  threat  class. 

These  problems,  and  others  that  will  be  mentioned,  suggest  that  several 
different  kinds  of  procedures  will  be  required  in  the  central  data- 
processing  facility.  Some  of  these  procedures  will  now  be  discussed. 
Before  doing  this,  however,  it  will  be  noted  that  the  simple  scheme 
that  has  beer,  described  does  not  indicate  many  features  that  may  be 
required  in  a  real  complex,  e.q.,  means  for  modifying  the  operation 
of  a  component  system  in  response  to  strategic  intelligence  or  to  in¬ 
formation  received  from  another  system,  or  means  for  dynamically  allo¬ 
cating  communication  channel  capacity  to  the  several  reporting  links 
in  response  to  actions  taken  against  the  complex  itself. 

The  first  kind  of  integration  that  will  be  considered  involves 
outputs  from  two  similar  systems  that  have  a  common  spatial  region  un- 
uer  surveillance  and  that  provide  nearly  coincident  event  detections 
and  threat  descriptions  on  a  common  threat  class.  In  processing  these 
reports,  the  central  data -processing  facility  attempts  to  match  the 
two  sets  of  descriptions  for  threats  that  are  detected  in  the  common 
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surveillance  region.  This  can  be  done  in  near-real  time,  because  (by 
assumption)  the  detection  reports  from  each  system  will  be  nearly  coin¬ 
cident.  The  matching  operation  is  accomplished  by  comparing  the  event 
descriptions*  reported  by  one  system  with  those  reported  by  the  other, 
but  only  for  those  events  whose  descriptions  indicate  that  they  have 
occurred  within  the  common  surveillance  region  for  the  two  systems. 

The  results  of  this  processing  can  take  the  following  forms: 

1.  Unambiguously  verified  events 

2 .  Partially  verified  events 

3.  Unresolved  (ambiguously  verified)  events 

4 .  Unverified  events 

5.  Unverifiable  events 

In  the  first  instance,  a  single  event  description  from  one  system 
matches  sufficiently  well  with  a  single  event  description  from  the 
other  system  that  the  comparison  criteria  are  satisfied;  the  two  sets 
of  lata  can  then  be  merged  into  a  single  report  and  a  single  composite 
event  description.  In  the  second  instance,  the  comparison  process 
indicates  that  the  two  event  descriptions  partially  agree,  but  dis¬ 
crepancies  disallow  high  confidence  that  they  can  be  merged  into  a 
single  report.  Unresolved  event  verifications  result  when  two  or 
more  descriptions  from  one  system  agree  sufficiently  well  with  one  or 
more  descriptions  from  another  system  to  satisfy  the  comparison  criteria 
thus,  while  the  event  occurrences  are  verified,  the  pairing  to  form 
composite  descriptions  is  ambiguous.  The  fourth  case  refers  to  events 
detected  by  one  system  that  should  have  been  detected  by  the  other; 
such  cases  arise  because  of  failure  to  detect  or  because  errors  in 
the  -descriptions  cause  a  failure  to  match  the  reports.  Unverifiable 
events  are  those  that  are  detected  outside  the  common  surveillance 
region  and  must  therefore  be  treated  as  reports  from  an  isolated  system. 

The  most  obvious  data  for  purposes  of  comparison  are  time  of 
occurrence  and  kinematic  descriptors.  Other  signature  data  may 
be  available  for  comparison  purposes,  depending  on  the  nature 
f  the  sensors.  Some  data  may  be  useful  for  verification  only 
through  the  process  of  consistency  determination,  which  will  be 
discussed  subsequent!” . 
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There  is  a  fairly  obvious  trade-off  between  the  statistics  of  the 
output  of  the  matching  operation,  the  stringency  of  the  comparison 
criteria,  and  the  quality  of  the  event  description  data.  Use  of  more 
stringent  comparison  criteria  will  lead  to  fewer  false  verifications 
and  fewer  ambiguous  verifications ,  but  to  more  partially  verified  and 
unverified  events.  The  interpretation  of  the  outputs  hinges  on  quan¬ 
titative  knowledge  of  the  joint  event-detection  and  description-error 
statistics  for  the  two  systems. 

The  next  situation  to  be  discussed  is  that  of  two  similar  systems 
that  monitor  activity  in  a  common  threat  class,  but  provide  reports  on 
such  activity  at  different  times.  In  such  cases,  the  descriptions 
provided  by  the  later  reporting  system  will  be  time -transformations  o-r 
the  descriptions  provided  by  the  earlier  reporting  system.  In  this 
case,  the  verification  process  involves  predicting,  from  the  earlier 
descriptions,  the  quantitative  character  of  the  descriptions  that  will 
be  provided  later.  An  example  of  this  procedure  is  the  use  of  tra- 
jectcrv  data  from  a  boost-phase  ICBM  detection  system  to  predict  the 
kinematic  descriptions  that  would  be  observed  with  a  mid-course  or 
early  reentry  detection  system.  The  output  of  the  integration  process 
has  the  same  structure  as  was  described  previously;  in  general,  how¬ 
ever,  the  comparison  criteria  must  be  less  stringent,  to  accommodate 
prediction  errors . 

The  third  case  to  be  discussed  is  the  most  difficult  from  the 
standpoint  of  data  processing.  Here,  two  systems  monitor  activity  in 
the  me  threat  class,  but  are  so  dissimilar  that  credible  verification 
by  direct  or  predictive  description  comparison  is  no*-  possible.  Even 
so,  the  descriptions  provided  ma^  have  substantially  similar  content; 
the  question  arises  as  to  whether  pairings  can  be  made  on  the  basis  of 
a  determination  of  mutual  consistency  of  the  data.  While  a  true  veri¬ 
fication  may  not  be  possible,  it  may  be  feasible  to  establish  "most 
likely"  associations  of  the  events  reported  by  one  system  with  those 
reported  by  another.  Consistency  determination  is  accomplished  by 
ascertaining  whether  there  exists  a  reasonable  hypothetical  character¬ 
isation  of  the  event  that  can  lead  to  a  synthetic  composite  description, 


some  of  whose  components  agree  sufficiently  well  with  the  d 
provided  by  one  system,  and  some  which  agree  sufficiently  w 
the  other  description.  The  problem  here  is  to  generate  a  h; 
set  that  is  sufficiently  detailed  that  it  provides  the  requ 
thetic  composite  description  for  comparison  purposes,  but  si 
concise  that  it  allows  the  central  data  processor  to  scan  tl 
set  (in  r,eal  time)  before  rejecting  a  pairing.  To  some  extf 
techniques  for  ordering  of  the  search  program  can  expedite  t 
dure,  but  the  requirements  for  data  processing  may  still  be 

The  final  case  is  one  for  which  integration,  as  such,  j 
sible;  when  two  systems  are  monitoring  activity  in  disjoint 
classes.  Here  the  data  can  be  aggregated  only  at  the  grosse 
and  the  evaluation  problem  is  one  of  determining  whether  the 
manifestations  reported  have  apparent  objectives  that  are  cc 
with  a  reasonable  hypothec-1  <-al  attack  plan. 

These  discussions  are  intended  to  indicate  the  complexi 
task  of  integrating  warning  data  from  multiple  warning  syste' 
purpose  of  attempting  such  a  formidable  undertaking  is  of  co 
provide  the  NCA  with  the  most  accurate  i  id  credible  descript 
impending  attack,  despite  the  diversity  of  forms  that  such  ai 
can  assume . 

C.  SPECIFICATIONS 

A  subset  of  possible  warning  system  specifications  will 
cussed  here;  the  example  used  is  that  of  a  warning  system  det 
detect  the  initiation  (launching)  of  an  ICBM  attack  against  t 
States-  The  numbers  used  to  illustrate  the  specification  co 
largely  hypo* helical,  but  the  concepts  are  not. 

The  specification  task  is  complicated  by  the  following  i 

1.  Certain  natural  phenomena  may  give  rise  to  signature 
by  the  system  that  it  interprets  as  being  character! 
missile -launch  activity;  this  contingency  will  be  re 
as  a  natural  launch-detection  false  alarm.* 

-I--'  -I  ~  ■  I  - 

No*  to  be  confused  with  a  falre  warning. 
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2-  The  natural  false  alarms  alluded  to  can  r.ugmented  by  de¬ 
tections  of  nonbelligerent  launch  activity,  e.g.,  launching 
of  nonbelligerent  satellite  vehicles  and  tests  of  missile 
systems . 

3.  Under  certain  conditions,  interactions  between  natural  phenom¬ 
ena  and  nonbelligerent  activities  can  cause  the  response  of 
a  sensor  (the  signature)  to  be  confused,  resulting  in  mis- 
classification  of  the  event  and  other  errors. 

In  addition,  certain  attack-staging  procedures  may  permit  an  attacker 
to  achieve  a  sizeable  total  attack  capability  without  exceeding  alert¬ 
ing  thresholds  that  are  based  on  elementary  launch-rate  (or,  more  prop¬ 
erly,  launches  per  specified  unit  of  time)  criteria. 

For  the  moment,  an  attack  will  be  defined  as  the  launching  of 
or  more  missiles  against  United  States  targets  within  minutes;  it 
will  be  required  that  the  system  provide  at  least  minutes  warning,* 
with  a  warning  probability  not  less  than  Pw>  Representative  values 
might  be  as  follows: 


na  = 

20 

(1) 

ta  = 

5  minutes 

(2) 

Tw  = 

20  minutes 

(3) 

rn 

ii 

0.95 

(4) 

Th  reason  for  specifying  C.95  for  warning  probability  is  beyond  the 
scope  of  this  paper  and  involves  the  subjective  determination  of  the 
contribution  made  to  deterrence  by  the  warning  system.  The  most 
"deterrent"  warning  system  would  provide  warning  with  certainty,  but 
it  seems  apparent  that  if  the  odds  against  sneaking  through  the  warning 
system  are  very  high  (19-to-l  for  the  present  specification),  then  the 

As  stated  here,  the  specification  implies  that  a  warning  message 
must  be  delivered  to  the  user  at  least  %  minutes  prior  to  first 
impact .  An  alternative  requirement  is  that  warning  be  provided 
no  more  than  Tty  minutes  after  the  first  launch.  We  use  the  first 
form  because  it  seems  more  relevant. 
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warning  system  is  practically  as  deterrent  as  one  for  which  the  warning 
is  unity.  It  remains  an  open  question  as  to  whether  a  value  of  0.8, 
for  example,  would  be  sufficient. 

In  addition  to  the  warning  statistics,  the  false-warning  perform¬ 
ance  must  also  be  specified.  Determination  of  an  acceptable  false- 
warning  rate,  (the  frequency  with  which  the  system  delivers  warning 
messages  to  the  user  when  no  attack  is  actually  occurring),  depends 
critically  on  the  use  that  would  be  made  of  the  warning  message.  It 
is  to  be  noted  that  there  would  most  likely  be  a  spectrum  of  responses, 
some  of  which  would  be  made  in  response  to  warning  messages  generated 
with  different  values  of  N^,  and  some  of  which  would  be  made  only  in 
response  to  verified  messages,  the  verification  or  corroboration  being 
made  by  two  or  more  independent  warning  systems  in  the  complex.  For 
the  sake  of  discussion,  it  will  be  assumed  that  the  launch-count  cri¬ 
terion  specified  above  results  in  messages  that  are  used  only  to  alert 
strategic  forces*  and  are  subject  to  corroboration  prior  to  more  sub¬ 
stantive  commitments.  With  this  restriction,  it  seems  reasonable  to 
assume  that 

Ry  =  2  per  year  (5) 

would  be  acceptable. 

The  reaction  of  the  system  to  the  nonbelligerent  activity  referred 
to  in  2  above  must  also  be  specified.  We  will  state  this  specification 
somewhat  arbitrarily:  the  probability  that  the  system  will  deliver  a 
warning  message  in  response  to  the  launching  of  M  or  fewer  vehicles 
within  an  interval  of  minutes  shall  not  exceed  Q^;  for  the  sake  of 
discussion,  the  values 

%  =  0-1  (6) 

M  =  5  (7) 

will  be  adopted. 

This  need  not  rule  out  the  possibility  of  a  more  stringent 
criterion,  e.g.,  =  100,  for  warning  messages  that  would 

produce  a  more  serious  response. 


We  will  not  attempt  to  describe  specifications  for  a  warning  com¬ 
plex.  Some  notions  as  to  the  form  that  these  might  take  are  implicit 
in  the  preceding  disci-ssion  and  in  the  analyses  that  follow. 


IV.  SINGLE-SYSTEM  IMPLICATIONS 


A.  EVENT -DETECTION  CAPABILITIES  AND  WARNING  THRESHOLDS 

It  will  be  assumed  that  the  decision  procedure  employed  by  the 
warning  system  in  generating  warning  messages  is  equivalent  to  the 
scheme  depicted  in  Fig.  2.  Event  detections  (e.g.,  detections  of  IC^M 
launches)  are  delivered  to  a  delay-and-counter  combination,  which  simply 
counts  the  number  of  detections  that  have  occurred  in  the  past  T^  min¬ 
utes  .  The  warning  message  generator  compares  the  counter  reading  with 
a  threshold  number,  N^,  and  generates  a  warning  message  only  when  the 
counter  reading  goes  from  N.,-1  to  Nw. 


WARNING 

MESSAGES 


FIGURE  2.  Elementary  Warning  Decision  Process 

This  scheme  is  applicable  regardless  of  whether  the  event  de¬ 
tections  have  been  previously  sitv^  the  basis  of  the  correspond¬ 

ing  event  descriptions)  to  discriminate  against  apparent  detections 
whose  descriptions  do  not  correspond  to  known  threat  classes.  It  is 
also  entirely  conceivable  hat  the  warning  message  generator  may  em¬ 
ploy  more  than  one  threshold,  generating  messages  of  greater  signifi¬ 
cance  when  higher  counting  thresholds  are  reached. 
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Now  suppose  that  detections  of  real  events  are  statistically 
characterized  by  the  binomial  distribution.  That  is,  let  P£  denote 
the  probability  that  a  single  event  is  detected,  and  make  two  assump¬ 
tions  : 

1.  A  single  event  leads  to  a  single  event  detection,  at  most. 

2.  Individual  event  detections  are  mutually  statistically  in¬ 
dependent  . 

Then  the  probability  that  the  launching  of  N^  missiles  within  Tft  min¬ 
utes  will  result  in  the  generation  of  a  warning  message  is  given  by 


W 


■'t  (■:)•;  Mv 


(8) 


n=N, 


W 


Some  additional  qualifying  remarks  are  in  order.  First,  Eq.  8  does 
not  include  the  effect  of  coincidental  false  event  detections  that 
could  increase  the  apparent  number  of  events  detected  during  the  onset 
of  the  attack;  it  is  therefore  conservative  in  this  regard.  Second, 
the  occurrence  of  more  than  events  within  T^  minutes  will  increase 
the  probability  of  generating  a  warning  message  above  the  value  com¬ 
puted  using  Eq.  8.  Third,  if  the  N  events  are  spread  out  over  an 
interval  of  duration  greater  than  Tfl  minutes,  the  probability  of  gen¬ 
erating  a  warning  message  will  be  reduced.  In  this  instance,  a  (pos¬ 
sibly  quite  crude)  lower  bound  on  the  probability  of  generating  a  warn¬ 
ing  message  is  obtained  by  replacing  in  Eq.  8  with  the  maximum  num¬ 
ber  of  events  occurring  within  a  Tft  -  minute  interval.  Finally,  the 
underlying  model  does  not  apply  to  situations  for  which  eventual  de¬ 
tection  of  individual  events  is  practically  certain  but  in  which  the 
most  significant  elements  of  variability  are  the  times  at  which  such 
detections  take  place. 

More  recondite  formulas  can  be  developed  that  overcome  some  of 

these  limitations,  but  Eq.  8  will  suffice  for  the  present  purpose, 

which  is  to  delineate  a  relationship  between  and  P^  in  attaining 

a  required  value  for  P...  Such  a  relationship  is  exhibited  in  Table  1, 

w 
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which  lists  the  values  of  required  to  achieve  specified  values  of 
Pw  for  a  given  threshold  N^,  given  that  Nft  =  20  events  that  have  oc¬ 
curred  within  the  counting  interval  T^. 


TABLE  EVENT-DETECTION  PROBABILITIES  (?e)  REQUIRED  TO  ACHIEVE 
A  SPECIFIED  WARNING  PROBABILITY  OF  AN  ATTACK  BY  20 
MISSILES  (BINOMIAL  MODEL) 


Warning 

Threshold 


Required  Value  of  The 
Probability  of  Warning  Pw 


Nw 

0.95 

0.90 

0.85 

0.80 

6 

0.456 

0.415 

0.388 

0.366 

7 

0.508 

0.467 

0.440 

0.418 

8 

0.558 

0.518 

0.491 

0.469 

a 

0.606 

0.567 

0.541 

0.519 

10 

0.653 

0.615 

0.589 

0.568 

11 

0.69b 

0.662 

0.637 

0.616 

12 

0.741 

0.707 

0.683 

0.663 

13 

0.783 

0.751 

0.728 

0.709 

14 

0.823 

0.793 

0.772 

0.755 

15 

C  .860 

0.834 

0.815 

0.799 

16 

0 . 896 

0.873 

0.856 

0.842 

17 

C  .929 

0.910 

0.895 

0.883 

18 

0.958 

0.944 

0.932 

0.922 

19 

0.982 

0.973 

0 . 966 

0.959 

on 

0.997 

0.995 

0.992 

0.989 

Figure  3  presents  some 

of  the 

data  of  Table  1  in  graphic  form 

hows  that  the  required 

values 

of  P„  are 

relatively  insensitive 

.  specification  of  F, ,, 

A 

over  the  range  of 

values  being 

considered . 

:tual  fact,  P„  will  itself  be  a 

variable , 

depending  on 

the  t ime 

:c urrence  of  the  event. 

the  location  of  the  event  within  the  cover 

.:  \~ai:.  of  the  system,  and  the  particular  Rind  ox  event  within  the 


threat  class  being  monitored.  The  value  of  PE  =  0.70  will  be  adopted 
as  representative;  Table  1  then  indicates  that  a  threshold  value  Nw  =  11 
can  be  employed. 


FIGURE  3.  Relationship  Between  Event-Detection  Probability,  Probability  of 
Warning  and  Warning  Threshold 

It  is,  of  course,  generally  desirable  to  use  as  high  a  threshold 
value  as  possible  to  minimize  the  false-warning  rate,  but  there  are  im¬ 
portant  qualifications  to  this  remark.  If  the  warning  system  were  im¬ 
proved  to  yield  ;JE  =  0.99,  for  example,  an  obvious  reaction  would  be  to 
increase  the  threshold  Nw  to  19,  say.  Doing  so,  however,  would  in¬ 
crease  the  possible  level  of  a  '’sneak-through"  attack  from  10  launches 
(in  the  case  Fw  =  0.70)  to  18  launches.  By  setting  the  threshold  at 
the  lowest  possible  value,  consistent  with  the  tolerable  false-warn- 
inq  rate,  the  range  of  possible  sneak-through  attacks  is  minimized, 
and  the  highest  possible  warning  probability  for  a  given  attack  size 
is  generally  obtained. 
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B.  FALSE -DETECTION  AND  FALSE-WARNING  STATISTICS 

The  average  false-warning  rate  associated  with  the  scheme  of 
Fig.  3  is  simply  the  false-event-detection  rate  multiplied  by  the 
probability  that  a  false-event  detection  is  preceded  by  exactly  Nw  -1 
event  detections  in  the  previous  T^  minutes.  Assuming  that  the  oc¬ 
currence  of  false-event  detections  is  characterized  by  the  Poisson 
distribution  and  that  the  false-event-detection  rate  is  constant,  the 
false-warning  rate  is  given  by 


R 


V1 

(Re  ta)  w 

w  ~  re  Tnw  -  TTT  exp  ('re  ta> 


(9) 


where  R  denotes  the  false-event-de .ection  rate.  If  R_  is  not  a  con- 
E  k 

stant,  but  varies  in  time,  then  Ry  is  also  dependent  on  time,  and  is 
given  by 

N.,-1 

[Rp( t)  T.]  W 

VtJ  “  re(c)  -71Tw--  i)l  C-Rf<0  V  (10) 


where 


R£(t)  =  (1/TA)  J  RE(t')  dt 

t- 

L  “1  . 


(11) 


Eqs .  10  and  11  are  presented  as  a  matter  of  record;  in  what  follows, 
it  will  be  assumed  that  Rr  is  constant. 

4_r 

Table  2  lists  some  values  for  R^  for  given  values  of  R^,  for  the 
standard  case  T^  =  5  minutes,  =  11.  It  can  be  seen  that  the  false- 
warr.ing  rate  is  quite  sensitive  to  the  false-event-detection  rate.  For 
a  false-warning  rate  of  2  per  year,  the  tolerable  false-event-detection 
rat*.-  is  per  hour,  but  an  increase  of  R  to  21.5  per  hour  will  re¬ 

sult  in  R,  being  3  per  year. 
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TABLE  2.  FALSE-WARNING  RATE  AS  A  FUNCTION  OF  FALSE- 
EVENT  -DETECTION  RATE 


False-Event-  False-Warning 

Detection  Rate,  R  Rate,  Ry 

(per  hour)  (per  year) 


1 

3.6 

X 

10"14 

2 

6.8 

X 

10"11 

5 

1.3 

X 

Hf6 

10 

1.7 

X 

io'J 

20 

1.5 

50 

5.0 

X 

10" 

100 

9.4 

X 

4 

1C 

Integration  Time,  T^,  =  5  minutes 

Warning  Threshold,  Nw*  =  11 

These  calculations  are  valid  only  if  the  underlying  model  for 
false-event  occurrences  is  satisfactorily  approximated  by  the  Poisson 
distribution.  The  consequences  of  one  possible  departure  from  simple 
Poisson  statistics  will  now  be  discussed;  the  bulk  of  the  analysis 
supporting  this  discussion  is  given  in  Appendix  A. 

It  will  be  assumed  that  the  departure  from  the  simple  Poisson 
model  used  above  can  be  represented  by  the  superposition  of  three 
statistically  independent  false-event-detection  sequences: 

1.  Singlets :  a  Poisson-distributed  random  sequence  of  false- 

event  detections  similar  to  the  sequence  implicit 
in  Eq .  9 . 
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2.  Doublets :  a  Poisson-distributed  random  sequence  of  pairs  of 

false-event  detections,  each  pair  occurring  within 
a  time  interval  that  is  small  compared  to  the  in¬ 
tegration  time,  T^. 

3.  Triplets :  a  Poisson-distributed  random  sequence  of  groups  of 

three  false-event  detections,  each  group  again  oc¬ 
curring  within  a  time  interval  that  is  small  com¬ 
pared  to  T^. 


Letting  Rp  denote  the  average  singlet  rate,  Rp  denote  the  average 
rate  of  occurrence  of  doublets,  and  R£  '  denote  the  average  rate  of 
occurrence  of  triplets,  the  overall  false-event-detection  rate  is  given 
by 


RE  =  REX)  +  +  (12) 

This  model  has  been  assumed  because  it  is  more  or  less  analytically 
tractable;  there  is  a  possible  mechanism  that  would  support  its  rele¬ 
vance  to  real  situations. 

Suppose  that  there  exist  natural  phenomena  that  can  give  rise  to 
signatures  that  are  interpreted  as  being  real  events,  and  that  such 
signatures  are  detected  in  the  outputs  of  more  than  one  sensor  in  the 
Sensor  arx’ay  of  the  warning  system.  If  the  responses  of  the  sensors 
t  a  Poisson-distributed  sequence  of  such  natural  events  are  not  al¬ 
ways  perfectly  associated,  the  multiple  signatures  that  are  delivered 
to  the  system  central  processor  will,  on  occasion,  be  interpreted  as 
multiple  events.  A  r.atura’  event  that  produces  detectable  signatures 
in  two  or  more  sensors  in  the  array  can  lead  to  singlets  only  if  the 
association  of  the  signatures  is  perfect;  it  can  produce  doublets, 
triplets,  or  even  higher  order  events  if  two,  three,  or  more  of  the 
.  i  matures  are  nor  properly  associated. 

Figure  4  depicts  the  results  of  calculations  of  R^,  assuming 

■ha’  ‘he  overall  false-event-detection  rate,  R  ,  is  held  at  20.6  per 

E 

h  ur,  which  (as  was  noted  previously)  yields  R^,  =  2  per  year  under  the 
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singlet-only  model  implicit  in  Eq.  9.  Two  cases  are  shown: 


and 


0.1  R 


(2) 

E 


0.01 


As  before,  =  5  minutes  and  Nw  =  11.  It  can  be  seen  that  the  false- 

warning  rate  is  quite  sensitive  to  the  occurrence  of  doublets  and  trip¬ 
le ) 

lets,  approximately  doubling  when  R£  =  0.5  per  hour;  this  is  roughly 

equivalent  to  having  a  97.5  percent  probability  of  satisfactory  asso- 

(  2) 

ciation  of  two  signatures  from  a  single  natural  event.  When  R£  -  1 

per  hour,  the  singlet  rate  is  about  18.3  per  hour;  approximately  10 

percent  of  the  false-event  detections  appear  as  doublets  and  triplets . 

The  false-warning  rate  is  then  8  per  year  for  =  0.01  per  hour  and 

( 3)  L 

12  per  year  for  R'  =  0.1  per  hour.  For  an  example  of  the  consequences 

h  fl)  (2) 

of  rather  poor  association,  take  Rl.  -  6.8  per  hour,  Rj.  =  6  per  hour, 

/  -*  \  L  L 

and  J  ~  0.6  per  hour;  the  average  fa lse -warning  rate  is  then  ap¬ 
proximately  180  per  year,  or  about  one  every  2  days. 

As  an  extreme  example,  suppose  that  all  such  false-event  detec¬ 
tions  appear  as  doublets,  with  an  average  occurrence  rate  of  10-3  per 
hour  (or  20.6  false-event  detections  per  hour);  then  the  analysis 
(Appendix  A)  shows  that  the  average  false-warning  rate  is  149  per  year. 
Comparing  this  with  the  180-per-year  figure  just  cited  shows  the  ex¬ 
treme  sensitivity  to  triplets  and  higher  order  occurrences.  If  all 
the  20.6  per-hour  false-event  detections  appear  as  triplets,  the  re¬ 
sulting  false-warning  rate  is  over  1000  per  year  (approximately  3  per 
day  ) . 

To  summarize,  these  results  indicate  that  the  false-warning  per¬ 
formance  of  a  warning  system  is  critically  dependent  on  the  temporal 
rtati:  tical  structure  of  the  events  that  can  cause  false  warnings. 

In  par icular,  it  would  seem  that  great  care  must  be  exercised  to  pro¬ 
vide  very  high  pi  babilit ic s  of  perfect  association  of  multiple  re¬ 
sponses  to  natural  events. 
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FIGURE  4.  False-Warning  Rufe  for  Compound  Falsc-Lvent  IVhMton* 


The  specification  given  in  iAvl  ion  ill  t‘  Mat  'hat  t  It.  •  a 
ability  of  generating  a  warning  message  in  response  i  >•  t  h* 
of  M  =  5  or  fewer  vehicles  within  an  int<rval  '<1  *>  uutiut-  ■  l«i  I 
less  than  Q-  0.1.  An  import  an1  quest  ton  *n  tin:.  . . .  t  *  l>« 

•  which  the  event  descriptions  ext  ruet  »-d  !r>mi  <  h<  >t*  ■  <  *  1  •  -t 

signatures  provide  means  for  distinguishing  !»-t  w*  m  dir . 

threats.  We  will  not  address  <>wrs<  lv<:,  « *•  t  hi*.  «)«••-..*  •*  **»  h«  •  *  . 

♦  o  note  that  even  the  must  rudimentary  •  v*  nt  -<-i  e  il  e  n  (■•».  l» 
should  be  of  consicJ*.  rabl*.  valu*  in  suppr- inn  >inwnu*<<t  waining 
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A  second  question  is  whether  the  system  could  ever  generate  a 
warning  message  in  re?  gonse  to  the  launching  of  5  vehicles  when  the 
warning  threshold  is  set  above  5,  e.g.,  Nw  =  11.  The  answer  is  clearly 
no,  if  a  single  launching  at  most  can  give  rise  to  one  event  detec¬ 
tion  by  the  system.  As  has  been  noted  in  the  previous  section,  how¬ 
ever,  each  event  may  give  rise  to  more  than  one  detected  signature, 
because  the  event  may  generate  signatures  in  more  than  one  sensor  in 
the  system  array.  Thus,  unless  multiple  signatures  from  a  single  event 
can  be  perfectly  associated,  the  possibility  exists  that  the  launching 

of  fewer  than  N. ,  vehicles  can  lead  to  an  event  count  that  exceeds  N. , 

W  W 

and  causes  the  generation  of  a  warning  message. 

The  analysis  supporting  this  discussion  is  presented  in  Appendix  B. 
The  assumption  is  made  that  each  event  leads  to  a  response  (in  the 
form  of  either  no  detection  or  one  or  more  event  detections)  that 
is  statistically  independent  of  the  responses  made  to  the  other  con¬ 
current  events.  This  response  is  characterized  by  a  probability  vector 


PE 


/p(0)  p(l)  p(2)  \ 

\  E  ’  h  ?  PE  ’  j 


,00 


where  Pp  is  the  probability  that  the  °vent  leads  to  k  event  detec¬ 
tions  .  The  probability  that  the  event  is  detected  at  least  once  is  now 


=  i  -  p; 


It  will  be  recognized  that  Eq.  8  (for  the  probability  of  warning)  is 
conservative,  in  the  sense  that  it  reflects  at  most  a  single  event 
detection  in  response  to  an  event. 

T?  illustrate  the  sensitivity  of  Q  to  the  probability  of  double 
and  higher  order  detections,  a  few  numerical  examples  will  be  presented. 
In  all  cases,  it  is  assumed  that  N.^  =  11  and  that  5  vehicles  were 
launched . 


I 

1 
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Case  I 


k 

pOO 

fc 

0 

0.25 

PE  =  °‘75 

1 

0.40 

2 

0.20 

Q  =  0.06 

3 

0 .10 

4 

0.05 

Here  rhe  association  of  multiple  signatures  is  fairly  good;  for  53+ 
percent  of  the  events  that  are  detected,  the  aggregation  process 
yields  a  single  event  detection  for  each  event.  The  requirement  on 
Q  is  satisfied. 


Case  II 


k 

P(k) 

E 

0 

0.2 

PE  = 

0.80 

1 

0.2 

2 

0.2 

Q  = 

0.44 

3 

0.2 

4 

0.2 

Here  the  association  of  multiple  signatures  is  somewhat  poorer  than 
in  Case  1;  for  only  25  percent  of  the  events  that  are  detected,  the 
aggregation  process  yields  a  single  event  detection  in  response  to  a 
single  event.  The  requirement  on  Q  is  not  met. 

Case  III 


k 

pOO 

E 

0 

0.25 

PE  = 

0.75 

1 

0.05 

2 

0.10 

Q  = 

0.69 

3 

0.20 

4 

0.40 
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In  this  case,  the  association  is  rather  poor;  in  53+  percent  of  the 
events  that  are  detected,  the  aggregation  process  yields  4  event  de¬ 
tections  in  response  to  a  single  event.  The  odds  are  better  than  two 
to  one  that  the  system  will  generate  a  warning  message. 

The  implication  of  these  results  is  that  the  specification  con¬ 
straint  on  the  warning  system  response  to  nonbelligerent  activity  im¬ 
poses  a  restriction  on  the  design  of  the  system.  It  is  more  or  less 
obvious  that  the  probability  of  event  detection  can  be  increased  by 
increasing  the  number  of  sensors  in  the  warning  system  sensor  array, 
because  the  number  of  signatures  delivered  by  :he  array  in  response 
to  an  event  can  be  increased.  It  is  equally  more  or  less  obvious, 
however,  that  the  difficulty  of  achieving  perfect  aggregation  of  mul¬ 
tiple  signatures  from  a  single  event  (so  as  to  yield  c  single  event 
detection)  increases  with  the  number  of  signatures  that  are  made  avail¬ 
able.  If  (as  a  result  of  an  attempt  to  increase  the  probability  of 
event  detection)  the  aggregation  performance  is  moderately  degraded, 
the  effect  can  be  to  cause  the  system  to  generate  warning  messages  in 
response  to  nonbelligerent  activity  with  an  undesirably  high  prob¬ 
ability.  Thus,  concomitant  with  a  determination  of  the  number  and 
coverage  of  sensors  in  the  sensor  array,  there  must  be  a  determination 
of  the  capabilities  of  the  system  for  aggregating  multiple  signatures 
provided  by  the  array. 


31 


V.  IMPLICATIONS  FOR  THE  WARNING  COMPLEX 


A.  THE  INTEGRATION  CONCEPT 

The  discussion  in  Section  III-B  indicated  that  there  are  a  large 
variety  of  ways  in  which  the  outputs  of  several  warning  systems  in  a 
complex  can  be  combined.  In  this  section,  we  shall  consider  a  most 
rudimentary  scheme,  that  of  basing  decisions  by  the  complex  solely  on 
the  occurrence  of  warning  messages  from  the  individual  systems.  The 
descriptive  content  of  the  messages  is  ignored,  insofar  as  the  decision 
by  the  complex  to  transmit  a  warning  message  to  the  user  is  concerned. 
It  will  be  noted,  however,  that  matching  the  descriptive  content  of 
messages  from  different  warning  systems  is  a  very  powerful  technique 
for  suppressing  false-warning  messages  from  the  complex  and  is  prac¬ 
tically  essential  if  the  complex  is  to  provide  a  meaningful  description 
of  an  impending  attack. 

For  concreteness,  it  will  be  assumed  that  three  statistically  in¬ 
dependent  warning  systems  provide  the  inputs  used  by  the  complex  in 
deciding  whether  to  transmit  a  warning  message  to  the  user.  The  se¬ 
quence  of  false-warning  messages  generated  by  each  system  is  assumed 
to  be  governed  by  the  Poisson  distribution.  Three  possible  decision 
rules  for  use  by  the  complex  will  be  considered. 

1/3:  The  complex  transmits  a  warning  message  in  response  to  a 
warning  message  from  one  or  more  of  the  three  systems. 

2/3:  The  complex  transmits  a  warning  message  when  a  message  from 
one  system  is  corroborated  by  a  message  from  one  or  both  of 
the  other  systems. 

3/3:  The  complex  transmits  a  warning  message  when  a  message  from 
one  system  is  corroborated  by  messages  from  both  of  the 
other  systems. 
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For  the  second  and  third  rules  to  be  meaningful,  it  is  necessary  to 
specify  what  is  meant  by  corroboration.  Specifically,  a  warning  mes¬ 
sage  from  one  of  the  three  systems  will  be  said  to  be  corroborated  if 
a  warning  message  arrives  from  another  of  the  systems  within  a  time 
interval  (specified  relative  to  the  time  of  reception  of  the  first 
warning  message)  of  specified  duration,  minutes.  The  specification 
of  depends  on  a  priori  knowledge  of  the  uncertainty  in  the  time  of 
reception  of  the  corroborating  message  relative  to  the  time  of  recep¬ 
tion  of  the  original  message.  The  corroboration  interval  itself  may 
begin  as  soon  as  the  first  warning  message  is  received,  or  it  may 
commence  after  a  predetermined  delay. 

The  criteria  used  by  the  individual  systems  for  generating  initial 
warning  messages  need  not  be  the  same  as  the  criteria  for  generating 
corroborating  warning  messages.  Practically  speaking,  the  user  of 
warning  messages  will  undoubtedly  take  certain  actions  in  response  to 
a  message  from  a  single  warning  system,  and  more  significant  actions 
in  response  to  one  or  more  corroborations  of  the  initial  message.* 

The  possibility  also  exists  for  a  check-back  corroboration  rule. 
Under  this  rule,  reception  of  a  warning  message  from  one  system  elicits 
a  search  for  prior  activity  observed  by  another  system  that  would  nor¬ 
mally  have  delivered  its  warning  message  earlier  than  the  system  that 
actually  sent  the  warning.  This  permits  corroboration  from  event 
detections  that  were  insufficient  to  cause  generation  of  a  warning 
message  by  the  system  that  is  normally  earlier. 

B.  DETECTION  AND  FALSE-WARNING  RATE  PERFORMANCE 

Under  the  assumptions  that  have  been  stated,  the  probability  that 
the  complex  will  generate  a  warning  message  is  given  by 

P^c)  (1/3)  =  1  -  J  [l  -  P^i}]  (15) 

In  this  regard,  all  three  of  the  decision  rules  being  considered 
are  therefore  relevant,  different  weights  being  attached  to  messages 
generated  by  the  complex  under  different  rules. 
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under  the  1/3  rule,  where  is  the  probability  that  the  it*1  system 

will  generate  a  warning  message .  If  is  the  same  for  all  threee 
systems ,  then 


p*0  =  1'(1'Pw)3  (16) 

For  the  2/3  rule, 

4c,(2/n  =  pw1>[1  -( 1  -  Pc25)^  -  pc3))] 

+  pw2)  [i  -(x  -  Pc^K1  -  pc3))] 

♦  pO)  [x  -  (l  -  p")  (l  -  p<2,)J  C17) 


+  p<«  p<2>  p<3> 
WWW 


p(l) 

rw 


(2)  (1)  (3) 

rw  "  w  w 


where  is  the  probability  that  the  x  n  system  will  generate  a 

corroborating  warning  message.  If  tne  three  systems  yield  equal  values 
for  Pw  and  Pc,  then  Eq.  17  simplifies  to 


p'C)C2/3) 


3  2 

W  Jtw 


+  3Pw  l1  -(*  -  pc)2] 


(18) 


For  the  3/3  rule, 


P(c)(3/31  -  P(1)  P(2)  P(3)  +  P^  P<2>  pC3)  +  p(D  p(2)  p(3) 

*W  o/o;  -  tw  pw  pw  +  tc  Pc  +  Pc  Pw  Fc 

(1)  (2)  (3)  _  p(l)  p ( 2 )  (3)  (1)  (2)  (3)  p(l)  p(2)  p(3) 

c  c  w  rw  w  c  w  rc  w  ~  c  *w 


(19) 


Again,  if  the  three  systems  yield  identical  values  for  Pw  and  Pp, 


P^C)(3/3) 


P0  +  3P  P2  -  3?^  P 
lW  W  fC  W  C 


(20) 
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Table  3  gives  values  for  P^c)  (1/3),  P^c)  (2/3),  and  P^c)  (3/3), 
as  given  by  Eqs .  16,  18,  and  20,  as  functions  of  P^,  under  the  assump¬ 
tion  that  P^  =  Pw>  which  is  equivalent  to  saying  that  identical  cri¬ 
teria  are  employed  for  generating  initial  and  corroborating  warning 
messages .  It  can  be  seen  that  the  triple  redundancy  provided  by  the 
1/3  rule  yields  values  for  the  probability  of  warning  by  the  complex 
which,  for  P^  =  0.5,  exceed  those  obtained  using  the  3/3  rule  with 
P^  =  0.95.  If  the  single-system  specification  of  P^  =  0.95  is  met, 
however,  then  the  value  of  P^c^  that  is  obtained  using  the  3/3  rule 
may  be  satisfactorily  high. 


TABLE  3.  PROBABILITY  OF  WARNING  FROM  THE  COMPLEX  AS  A  FUNCTION  OF 
PROBABILITY  OF  WARNING  FROM  A  SINGLE  SYSTEM  (THREE-SYS¬ 
TEM  COMPLEX) 


pw 

P^C)  0/3) 

P^C)  (2/3) 

Pwe)  (3/3) 

0.95 

0.9999 

0.9927 

0.8574 

0.90 

0.9990 

1.9720 

0.7290 

0.85 

0.9966 

0.9392 

0.6141 

0.80 

0.9920 

0.8960 

0.5120 

0.75 

0.9844 

0.8437 

0.4219 

0.70 

0.9730 

0.7840 

0.3430 

0.60 

0.9360 

0.6480 

0.2160 

0.50 

0.8750 

0.5000 

0.1250 

C c ) 

Although  the  2/3  rule  does  not  yield  values  of  P^  '  as  high  as 
those  obtained  with  the  1/3  rule,  it  does  give  values  that  are  quite 
respectable  over  a  range  of  attainable  values  for  Pw-  Corroboration 
in  effect  degrades  the  probability -of -warning  performance  of  the  com¬ 
plex,  relative  to  that  achievable  using  the  1/3  rule,  but  the  false- 
warning  rate  associated  with  the  2/3  rule  is  vastly  superior  to  the 
false-warning  rate  associated  with  a  1/3  complex. 
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The  false -warning  rate 
rule  is  given  by 


associated  with  a  complex  using  the  1/3 
3 

V 

i=l 


^C)U/3)  =  £  R< 


(i) 


(21) 


For  the  2/3  and  3/3  rules,  it  is  convenient  to  define  a  false- 
corroboration  probability,  which  is  the  probability  that  the  i^ 

system  v.ill  generate  a  false  corroborative  warning  message  during  the 
corroboration  time  interval  (of  duration  T^,). 

For  the  complex  using  the  2/3  rule,  the  false-warning  rate  is 
given  by 

^>(2/3,  -  [f  >  ♦  q<3>  -  4»] 


which  reduces  to 


*  [o'11  ♦  ^ } 

♦  ^  Hl)  *  i2)  -  i2i] 

KyC)(2/3)  =  SEy  [2  -  q|] 


(22) 


(23) 


when  the  systems  are  statistically  identical. 

The  false-warning  rate  of  a  complex  using  the  3/3  rule  is  given  by 

^c)(3/3)  =  R^1}  0^2)  0^3)  +  R^2)  ^C3)  +  ^3)  ^2) 

(24) 

which  simplifies,  when  the  three  systems  are  statistically  identical,  to 


4°  (3/3)  =  3^ 


(25) 
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The  problem  of  calculating  is  nontrivial,  involving  what  are 
known  as  clustering  statistics.  For  example,  suppose  that  for  corrob¬ 
oration  purposes  the  configuration  of  Figure  3  is  used,  with  a  thresh¬ 
old  Np.  Then  is  the  probability  that  false-event  detections 
occur  during  an  interval  of  duration  T^,  at  some  time  during  the  cor¬ 
roboration  interval  .  First,  let  C  (k;  m,  T^/T^,)  be  the  probability 
that  if  m  false-event  detections  occur  within  the  interval  T^,,  k  or 
more  of  them  fall  within  an  interval  of  duration  T^.  The  computation 
of  this  probability  is  discussed  in  Appendix  C.  Under  the  assumption 
that  false-event  detections  are  governed  by  the  Poisson  distribution, 
the  probability  of  a  false  corroborative  warning  message  is  given  by 


^  -z 


<re  v 

m! 


m 


exp  (-Re  T„)  C  (Nc,  m;  Tfl/Tc)  (26) 


m=N, 


where  R„,  as  before,  is  the  false-event  detection  rate.  It  will  be 

L 


recalled  that  for  Tfl  =  5  minutes,  R^ 


20.6  per  hour,  and  Nw  =  11,  a 


system  false-warning  rate,  R^,  of  2  per  year  is  obtained.  Assuming 
Tp  =  10  minutes,*  the  following  values  are  obtained  in  Appendix  C 
for  C^: 


=  0.00265 


for  N, 


and 


0.000019 


for  N, 


N.. 

to 


11 


ing  t h< results,  a  comparison  between  the  average  false-warning 
rates  for  complexes  using  the  1/5,  2.5,  and  5/5  rules  can  be  made  by 
s:<  a:\s  1  F.qc-  .  21,  23,  and  25: 


R(c)(i/5) 


re  r  vear 


1  2  months 


Ibis  value  is 


rr.bably  fairly  conservative. 


8 


R^jC^(2/3)  =  0.032  per  year  =  1/31  years 

R^c)(3/3)  =  4.2  x  10"5  per  year  =  1/24,000  years 

Nc  =  11 


R,'C)(2/3) 

=  2.4  x  10-4 

per  year  - 

1/4200  years 

^C,(3/3) 

=  1.2  x  10“9 

per  year  = 

1/800  million  years 

This  comparison  shows  th<~  rather  profound  effect  that  the  corrobora¬ 
tion  requirements  of  the  2/3  and  3/3  rules  have  on  the  false-warning 
rate  from  the  complex. 

In  addition,  it  seems  apparent  that  the  criteria  used  by  the  in¬ 
dividual  warning  systems  for  corroboration  need  not  be  as  stringent  as 
the  criteria  for  initial  warnings.  It  should  be  noted  in  this  regard 
that  the  use  of  a  corroboration  threshold  (Nc)  that  is  lower  than  the 
warning  threshold  was  not  reflected  in  the  warning  probability  calcula¬ 
tions  presented  in  Table  3,  and  the  results  presented  there  for  com¬ 
plexes  using  the  2,  3  and  3/3  decision  rules  must  therefore  be  regarded 
as  conservative .  For  example,  the  first  entry  in  Table  3  ( P,  -  0.95) 
is  obtained  for  N.  -•  20,  N  =  11,  and  P  =  0.7.  For  these  parameter 
values,  the  corresponding  corroboration  probability,  ,  is  0.9987 
(instead  of  9.95)  if  ~  8,  and  the  probability  of  warning  for  a  coffl- 
x  using  the  3/3  rule  is  0.9960  instead  of  9.6574,  as  given  in  Table 

It  sh  :uld  be  noted  that  the  effect  of  multiple  false -event  detec- 
ti  m  _>.f  the  variety  discussed  in  Section  IV-3  will  Ik-  to  increase 
the  values  obtained  for  O,,  perhaps  dramatically . 
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C.  WARNING  TIME  CONSIDERATIONS 


Tlk  discussions  presented  here  are  quite  primitive  and  are  based 
on  the  elementary  remark  that  i  the  warning  complex  employs  a  deci¬ 
sion  rule  requiring  corroboration,  such  as  the  2/3  and  3/3  rules  that 
have  been  considered  above,  then  the  complex  must  wait  until  the  cor¬ 
roboration  requirements  have  been  met  before  it  can  transmit  a  warning 
message  to  the  user.  Conversely,  a  complex  that  does  not  require  cor¬ 
roboration  can  deliver  a  warning  message  as  soon  as  it  receives  a 
warning  message  from  the  first  system  to  detect  an  attack.  This  fairly 
obvious  point  may  have  some  bearing  on  the  selection  of  warning  sys¬ 
tems  in  general;  it  certainly  influences  the  design  of  individual  warn¬ 
ing  systems  in  the  complex.  For  example,  if,  in  a  two-system  complex, 
one  of  the  systems  can  be  expected  to  delivrtT>  a  warning  message  with  an 
average  warning  time  of  20  minutes  (for  a  particular  threat  class), 
and  if  such  a  message  must  be  corroborated  by  a  message  from  a  second 
warning  system  that  can  be  expected  to  respond  with  an  average  warning 
time  of  10  minutes,  then  there  is  little  justification  for  improving 
the  warning  time  of  the  first  system  to  (say)  25  minutes,  because  of 
the  obvious  point  that  the  average  warning  time  provided  by  the  com¬ 
plex  would  still  be  10  minutes. 


To  provide  an  analytical  assessment  of  the  effects  of  corrobora¬ 
tion  requirements,  a  comparison  will  be  made  between  a  three-system 
warnin- :  complex  using  the  1/3  decision  rule  and  a  similar  complex 
using  the  3  3  rule.  It  will  be  assumed  that  the  warning  times  pro- 
'.‘idt/d  by  the  individual  warning  systems  are  statistically  independent 
and  idi-nt ically  distributed.  Specifically*  it  will  be  assumed  that 
each  warning  system  delivers  a  warning  message  in  response  to  the  onset 


of  an  at  tack  with  probability  P, .  (as  before ),  and  that  if  such  a  mes- 

A 

sago  is  delivered,  it  will  arrive  at  the  complex  at  a  random  time  t  , 

which  it  unifortr.lv  distributed  between  T  .  and  7  ,  the  former  tirr 

min  max 

?  h<  minimum  warning  time  provided  by  the  system  (given  that  it 
nr.-  ta'is  a  warning  message  at  all),  and  the  latter  being  the  maximum 
warning  *  ir>.  that  the  system  is  capable  of  providing. 


The  complex  using  the  3/3  rule  cannot  generate  a  warning  un 
it  has  received  a  warning  message  and  two  corroborations .  Denot 
warning  time  provided  by  the  i1"*"1  system  by  t^\  and  let 


t(i)  _  -j. 

w _ mm 

T  -  T  . 
max  mm 


i  =  1,2,3 


Under  the  foregoing  assumptions,  u^,  U2>  and  u^  are  statistically  .ri¬ 
de  pendent  and  uniformly  distributed  over  the  interval  (0,  1).  T1 
probability  that  the  smallest  of  u^  is  less  than  u  (0  ^  u  £  1)  i:  hen 
given  by 


Prob  <  u  .  < 

I  mm 


u|  =  1  -  (l-u): 


This  result  corresponds  to  the  probability  distribution  of  the  Wc  ing 
time  afforded  by  the  last  of  the  three  messages  to  arrive  at  the  tri¬ 
plex,  which  in  turn  is  essentially  the  warning  time  provided  by  t 
complex  (with  appropriate  adjustments  in  T^n  and  T  x).  Thac  is 
’he  probability  distribution  of  the  warning  time  provided  by  a  cr  ■ 
plex  using  the  3/3  rule  is  given  by 


Pr--:  {  t^c)(3/3)  <  t|  - 
,  /t  -  Tmin  \ 

It  -  t  .  / 

V  max  mm/ 


p  _  t 

max  min 


rS  •  ( 


T  .  \ 

:  -  r  ]( 

max  min/ 


for  T  .  s  t  T 

mm  max 

It  is  then  a  fairly  straightf orward  matter  to  calculate  the  mean 
ing  time  provided  by  the  3/3  complex: 


t(c)(3'3)l  =  T  .  a  (1/4)  (:  -  T  .  \  ( 

(  f  mm  '  (  max  mini  v 


A  similar  computation  car  be  made  for  the  warning  complex  using 
the  1/3  rule,  except  that  the  procedure  is  somewhat  more  complex.  Let 


(31) 


(32) 


(33) 


It  will  be  recognized  that  p^  is  the  conditional  probability  that, 
given  that  at  Least  one  system  transmitted  a  warning  message  to  the 
complex,  exactly  k  did  so.  It  is  next  possible  to  compute  the  con¬ 
ditional  probability  distribution  of  the  warning  time  provided  by  the 
complex,  giver  .at  exactly  k  systems  generated  warning  messages.  The 
result  obtained  is  that 

k 

Prob{  t^c)(l/3)  <  t|kl  =  (~ - ^rr—)  (34) 

1  *  \max  min/ 


and  the  overall  probability  distribution  for  the  warning  time  pro¬ 
vided  by  the  1/3  complex  is: 


(35) 


The  average  warning  time  provided  by  the  1/3  complex  is  readily  calcu¬ 
lated  to  be 


P(c) 

lW 


(1/3)  =  E{t<c)(l/3)} 


(36) 


-  T  .  +  (T 


min 


(Tmax  "  Tminj  [(il 


T  . J  (P,/2)  +  (2P0/3)  +  (3P,/4) 
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For  Pw  =  0.95,  Eqs .  31-33  and  37  yield 


T{\C)(l/3)  =  T  .  +  0.737  (T  -  T  .  ) 

w  v  mm  max  mm 


(37) 


Thus,  if  T  -  T  .  is  5  minutes,  the  1/3  complex  will  provide  an 
max  mm  r  r 

average  warning  time  that  is  about  2.4  minutes  greater  than  the  average 
warning  time  provided  by  the  3/3  complex,  under  the  many  assumptions 
that  have  been  made . 

Computations  for  a  warning  complex  using  the  2/3  decision  rule 
will  not  be  presented,  but  it  can  be  stated  that  the  warning  time  ad¬ 
vantage  enjoyed  by  the  1/3  complex  over  the  2/3  complex  is  considerably 
less  than  the  advantage  over  the  3/3  complex.  Moreover,  it  should  be 
noted  that  the  time  required  to  obtain  corroborative  warning  messages 
may  be  less  than  that  required  to  generate  initial  warning  messages, 
if  the  criteria  for  corroboration  are  less  stringent  than  those  for 
initial  warnings . 

The  probability  distribution  assumed  for  the  warning  time  provided 
by  an  individual  system  is,  of  course,  purely  hypothetical.  The  actual 
distribution  will  depend  not  only  on  the  sensor  characteristics  and 
communication  and  processing  times,  but  also  on  the  attack  scenario. 


VI.  SUMMARY  AND  CONCLUSIONS 


We  have  reviewed  several  conceptual  questions  dealing  with  warn¬ 
ing  system  structures  and  organization,  and  means  for  combining  the 
outputs  of  multiple  warning  systems  into  an  aggregated  response  for 
a  warning  complex.  The  following  points  should  be  stressed: 

1.  The  necessity  for  multiple  and  diverse  warning  systems  to 
provide  adequate  spatial  and  temporal  coverage  of  a  variety 
of  present  and  future  threats 

2.  The  necessity  for  correlating  the  outputs  from  such  systems 
in  order  to  provide  effective  and  accurate  descriptions  of 
impending  attacks  and  to  minimize  false  warnings  and  their 
consequences 

3.  The  inherent  (but  not  necessarily  insurmountable)  difficulty 
of  correlating  outputs  from  diverse  types  of  warning  systems 

In  these  discussions,  several  important  questions  have  not  been  dis¬ 
cussed.  First,  the  role  of  human  participants  in  the  warning  decision 
process  has  been  completely  ignored.  The  position  taken  has  been  one 
of  examining  the  mechanistic  possibilities  for  warning  systems  and  the 
warning  complex,  recognizing  that  human  participants  can  always  be 
added  to  provide  procedural  modifications,  criteria  adaptation,  and 
other  supervisory  functions ,  and  to  accommodate  situations  that  were 
not  foreseen  when  the  equipment  was  designed.  This  viewpoint  may  be 
somewhat  contrary  to  the  generally  accepted  philosophy. 

Second,  the  need  for  adaptive  implementation  and  operational  con¬ 
cepts  has  not  received  proper  stress.  Changes  in  the  environment  of 
the  sensing  elements,  changes  in  the  structure  of  the  warning  complex, 
and  new  threat  classes  (which  may  not  be  immediately  identifiable  as 
threats)  impose  a  requirement  for  flexibility  and  selectivity  in  system 
capabilities  and  procedures. 
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Third,  the  interactions  between  tactical  warning,  strategic  of¬ 
fensive  forces,  and  strategic  defenses  have  not  been  properly  assessed. 
There  is  an  important  trade-off  between  warning  capabilities ,  offensive 
force  requirements,  and  defensive  requirements  that  should  be  examined 
in  depth,  with  the  aim  of  specifying  a  realistic  balance  of  resources 
allocated  to  these  components  of  deterrence. 

In  an  analytical  vein,  we  have  attempted  to  illustrate  some  of 
the  problems  of  determining  the  performance  of  a  warning  system  and 
a  warning  complex.  The  consequences  of  imperfect  association  of  mul¬ 
tiple  sensor  responses  to  false  and  real  events  have  been  examined, 
the  conclusion  being  that  while  provision  of  redundant  sensing  capa¬ 
bilities  can  provide  better  coverage  and  improved  attack  detection 
probabilities ,  the  advantages  may  be  offset  to  a  significant  degree 
by  false-warning  rate  increases  and  undesirable  warnings  generated  in 
response  to  nonbelligerent  activity.  On  the  positive  side,  it  has  been 
found  that  even  the  correlation  of  warning  system  outputs  at  the  grossest 
possible  level  is  capable  of  yielding  acceptable  probabilities  of  warn¬ 
ing  from  the  complex,  while,  it  the  same  time,  the  false-warning  rates 
obtained  can  be  easily  reduced  to  an  acceptably  low  rate,  e.g.,  one 
false  warning  per  several  decades  or  even  many  millenia.  Of  the  con¬ 
figurations  examined,  the  complex  using  the  2/3  decision  rule  appears 
to  offer  the  best  combination  of  detection,  false-warning  rate,  and 
reaction  time  performance,  although  such  an  inference  should  be  clearly 
recognized  as  being  sensitive  to  the  many  assumptions  made  during  the 
analyses . 

The  fact  that  such  performance  can  be  achieved  with  such  apparent 
ease  is  not  to  be  construed  as  obviating  the  need  for  higher  order 
techniques  for  integrating  warning  system  outputs.  In  the  final  anal¬ 
ysis,  the  output  of  the  warning  complex  must  be  used  by  human  decision 
makers.  The  bald  statement  that  an  attack  has  been  detected  and  cor¬ 
roborated  by  two  out  of  three  warning  systems  is  not  likely  to  be  as 
effective  as  such  a  statement  accompanied  by  an  integrated  description 
of  the  attack,  in  which  the  description  provided  by  one  of  the  systems 
is  demonstrated  to  be  consistent  with  and  reinforced  by  the  description 


provided  by  the  other.  Moreover,  in  addition  to  corroboration  in 
detail,  the  aggregate  description  of  the  attack  is  likely  to  be  sig¬ 
nificantly  more  comprehensive  and  accurate  than  any  of  the  individual 
descriptions  and  is  therefore  likely  to  be  far  more  useful  to  the 
final  decision  maker. 


APPENDIX  A 


COUNTING  STATISTICS  FOR  COMPOUND  POISSON  PROCESSES 

It  is  supposed  that  false-event  detections  can  occur  singly, 
in  pairs,  or  in  groups  of  three,  as  described  in  Section  IV-B.  The 
sequence  of  singlets,  the  sequence  of  doublets,  and  the  sequence  of 
triplets  are  assumed  to  be  mutually  statistically  independent,  and 
each  sequence  is  assumed  to  be  governed  by  the  Poisson  distribution. 
The  determination  of  the  false-warning  rate  associated  with  this  com¬ 
bination  of  false-event-detection  sequences  will  be  broken  down  into 
three  mutually  exclusive  cases. 

1.  Suppose  that  a  single  false-event  detection  has  just  been 

delivered  to  the  counter;  then  a  warning  message  will  be  generated 

in  response  *:o  that  detection  if  and  only  if  exactly  Nw  -  1  false- 

event  detections  occurred  in  the  previous  T,  minutes .  The  average 

A  fl} 

rate  of  occurrence  of  singlets  is  denoted  by  R^  ' ;  thus ,  the  rate 
of  false-warning  messages  that  are  triggered  by  singlets  is 


R, 


(1) 

W 


=  R 


(1) 


x  p  (\  -  1.  V 


(A-l) 


where  P  (n,  T)  is  the  probability  of  exactly  n  false-event  detections 
in  T  minutes . 


2.  Suppose  that  a  double  false-event  detection  has  just  been 
delivered  to  the  counter;  then  a  warning  message  will  be  generated  if 
either  II,,  -  2  or  N,.  -  1  false  event  detections  occurred  in  the  previous 
T^  minutes.  In  the  first  instance,  the  warning  message  will  be  trig¬ 
gered  by  the  first  detection  of  the  pair.  The  average  rate  of  occur- 

(2) 

rence  of  doublets  is  denoted  by  R2,  ;  thus,  the  rate  of  false-warning 

messages  that  are  triggered  by  doublets  is 
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o  (2 )  _  p(2) 

"  RE 


[P("w  ■  ta)  +  p(Nw  -  2>  ta)] 


(A-2) 


3.  Finally,  suppose  that  a  triple  false-event  detection  has  been 
delivered  to  the  counter.  A  warning  message  will  be  generated  if 
-  3,  Nw  -  2,  or  -  1  false-event  detections  occurred  in  the  pre¬ 
vious  minutes.  In  the  first  instance,  the  warning  message  will  be 
triggered  by  the  first  of  the  three  false-event  detections ;  and  in 
the  second,  the  warning  message  will  be  triggered  by  the  second  of  the 
three  false-event  detections  in  the  triplet .  The  average  rate  of 
occurrence  of  triplets  is  denoted  by  thus,  the  rate  of  false- 

warning  messages  that  are  triggered  by  triplets  is 

=  43)[p(nw  -  Ts)  +  P  (Nw  -  2>  ta)  +  p(“w  -  3>  ta)] 

Because  the  three  cases  just  considered  are  mutually  exclusive, 
the  overall  false-warning  rate  can  be  calculated  by  addition. 


42)  +  ^3) 


(A-4) 


Combining  these  results  yields 


*W  =  p('w  -  3>  Ta)[RE1>  +RE2>  +P43)] 

+  4w  -  2’  ta)[re2>  +re3)]  (a'5) 

+  p(Nw  -  3-  ta)[re3)] 

The  problem  is  therefore  reduced  to  one  of  calculating  P  (n,  T), 
given  the  rates  Rp1^,  R^2^,  and  R^.  Analytically,  this  expression 
is  given  by 
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P  (n,  T) 


x 


(A-6) 


The  sum  in  Eq.  A-6  is  taken  over  the  non-negative  values  of  k^,  k^, 
and  k^,  for  which 

kx  +  2k2  +  3k3  =  n  (A-7) 

An  easy  way  to  compute  P  (n,  T)  is  to  allow  k^,  2k2»  and  3k3  to  run 
from  zero  to  the  maximum  value  of  n  (i.e.,  Nw  -  1);  the  summand  of  Eq 
A-6  is  computed  only  when  the  value  of  n  obtained  from  Eq.  A-7  is  of 
interest.  The  computed  summands  are  then  sorted  according  to  Eq.  A-7 
and  added  to  sums  corresponding  to  the  values  that  are  of  interest. 
After  completion  of  this  process,  the  sums  are  multiplied  by  the  ex¬ 
ponential  indicated  in  Eq.  A-b  to  obtain  a  table  of  P  (n,  T). 
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APPENDIX  B 


MULTINOMIAL  DISTRIBUTIONS 


A  single  event  can  lead  to  0,  1,  2,  ...  event  detectior  .  It  is 
assumed  that  the  number  of  event  detections  obtained  by  the  .  stem 
from  an  event  is  statistically  independent  of  the  number  obtained  from 
every  other  event  and  that  the  statistical  characterisations  of  *:he 
events  are  identical.  Let  Pi;  '  denote  the  probability  '-hat  .  i  event 

L 

causes  the  system  to  obt  .in  k  event  detections  following  aggregation. 
Then  if  M  events  occur,  she  probability  that  the  system  will  ob  in 
unaggregated  detections  of  the  first  event,  k^  unaggrega. ed  detec¬ 
tions  from  the  second  event,  ...,  and  k..  unaggregated  detections  from 

th  M 

the  M  event  is  simply 

M 

Prob{kr  k2,  ...,  k^j.  =  P^V  (B-l) 

The  probability  Q  of  generation  of  a  warning  message  is  .obtained  by 
summing  this  expression  over  all  values  of  k^,  k0,  ...,  k^  for  which 


k1  +  k2  +  •  •  •  +  ^  a  N, 


W 


(B-2 ) 


That  is, 


Q 


EE  -E  l 


(B-3) 


K1 


M 


where  each  index  ranges  from  0  to  K,  which  is  to  be  chosen  so  that 


,00 


for  all  k  >  K 


and  the  summation  is  constrained  ’  v  Eq.  B-2. 
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Computation  of  Q  is  easily  accomplished  by  a  sorting  technique 
akin  to  that  mentioned  in  Appendix  A.  Alternatively,  M  numbers  are 
allowed  to  run  through  all  possible  combinations  (each  number  ranging 
from  0  to  K);  when  Eq.  B-2  is  satisfied,  the  summand  of  Eq.  B-3  is 
computed  and  added  to  a  sum  for  Q. 


APPENDIX  C 


CLUSTERING  STATISTICS 


Consider  a  random  time  sequence  of  events  that  is  characterized 
by  the  Poisson  distribution  and  by  an  average  occurrence  rate  R£.  The 
probability  that  exactly  m  events  occur  in  a  time  interval  is  then 
given  by 


f>  '  > 


<Re  Tc) 


m 


m!  eXp  (-"RE  TC^ 


(C-l) 


The  problem  to  be  discussed  here  is  the  determination  of  the  probability 
(Nc)  that  Np  or  m  "e  such  events  will  be  clustered  within  some  in¬ 
terval  of  duration  contained  within  .  This  question  is  treated 
at  length  in  a  paper  by  Turner  and  Warren.*  The  approach  is  to  de¬ 
termine  in  one  way  or  another  the  probability  C(Nn,  m;  T^/T^)  that, 
given  exactly  m  events  in  the  interval  T  ,  or  more  will  fall  within 

some  interval  of  duration  7,  contained  within  T„.  is  then  obtained 

by  multiplying  C(I«'C,  m;  T  Tc)  by  the  probability  or  exactly  m  events, 

P(m),  and  summing  over  those  values  of  m  for  which  C(N„,  m;  T,/T  )  is 

t  A  L 


nonzero : 


P(m>  C  ( Nt, 


(C-2) 


m- 


which,  using  L’q.  C-l,  yields  Cq.  26  of  the  text  . 

It  is  shown  in  th<->  rerorenced  paper  that  the  stipulation  that 


exactly  ,r.  Poicson-d;s ;  ribw.ci  events  have  'cctirred  in  ?_ 


quiva'vtr 


Pcbcr*  P.  Turtur  and  V.’avr.c  I'.  Warren,  dusty-ring  Etatf sties  :! 

■  iitii  rr.ly  i  1st  ributvd  Rar.djm  Variables  (>')  >  Rot  "arch  fa  po  r  1  b  5 
\  Ar !  lr.o*  on ,  Va  . :  Institute  for  Defense  Analyses,  November,  i9>  ') 
(SECRET ) .  'he  results  cited  here  arc  unclassified. 


to  a  stipulation  that  the  m  events  are  uniformly  distributed  ovei 
Moreover,  normalizing  the  time  variable  with  respect  to  leads 
an  equivalent  statement  of  the  problem  of  calculating  C:  given  r 
points  uniformly  distributed  over  the  unit  interval  (0,  1),  what 
the  probability  that  m  or  more  of  the  events  fall  within  an  intei 
a  (=  Ta/Tc ) .  Equivalently,  one  asks  for  the  probability  that  the 
smallest  interval  containing  m  points  is  less  than  a. 

A  general  analytical  expression  for  C(k,  m;  a)  is  not  known, 

though  J.I.  Maus  has  published  a  number  of  papers"  containing  spe 

t  l”"l 

ized  results.  In  general,  C(k,  m;  a)  is  an  m  '  order  polynomial 
a;  two  known  results  are 

C(m,  m;  a)  =  ma  -  (m-l)a 
which  is  the  distribution  of  the  range,  and 

C(m-1,  m;  a)  -  a1'  2^(l-2a)  m  (m-1)  +  a"  (m‘  -  m  +  2)J 

0  0  <  a  •:  1/2 

m 

(2a  -  if  1/2  b  a  •:  1 

In  the  referenced  papers,  a  Monte  Carlo  technique  was  used  1 
estimating  "'( k ,  m;  a)  for  2  s  k  <  m,  2  m  <  lb.  Comp  .iris  on  with 
theoretical  results  indicated  that  the  Monte  Carlo  estimates  were 
.,11:  to  two  doc  imal  pl  i  .  es.  The  out  a  obtained  •  rom  that  pap-  r  t 
in  rho  *  o*  th<"*  i$  followr.  r 


.  J.teph  I.  Nat:,  ""'he  Lit  triburi on  of  *V  dire  1 
rum  Cluster  f  P.irt:  a  Line."  J.  Armr.  Eta*.  A: 

pp.  L?2-.:6,  idt.-5 ;  "Pome  Probabilities  ,  Expoctati  ru 


an  ft  f 
rv  il: 


Lara*  ? 


h, 


an! 


As: 


C ( 8 ,  m;  1/2) 

C(ll,  m;  1/2) 

8 

0.0352* 

0 

9 

0.1445* 

0 

Id 

0.35 

0 

11 

0.55 

0.00586* 

12 

0.74 

0.0327* 

13 

0.88 

0.11 

14 

0.98 

0.22 

15 

1 

0.36 

!  These  data  were  then  combined  using  Eg.  25  of  the  text  to  yield  the 

stated  results  for  Q^, .  It  was  assumed  that  C  -  1  for  m  greater  than 
j  15. 

! 
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n  supplementary  notes 


fll  AM  TRAC  ▼ 


%a  SPONSORING  MILITARY  ACTIVITY 

Advanced  Research  Projects  Agency 
Washington,  D.C. 


Several  conceptual  questions  dealing  with  warning  system 
structures  are  discussed,  including  techniques  for  correlating 
the  outputs  of  multiple  warning  systems  that  compose  a  warning 
complex.  The  discussions  are  illustrated  by  a  number  of  elementary 
analyses,  dealing  with  warning  probabilities,  false-warning  rates, 
and  warning  times.  The  mathematical  calculations  pertain  to  hypo¬ 
thetical  automatic  event  detectors  and  automatic  decision  systems 
employing  the  outputs  of  such  detectors.  It  is  demonstrated  that 
the  use  of  multiple  sensing  elements  in  a  warning  system  implies 
a  need  for  proper  association  of  redundantly  detected  signatures 
of  real  events  and  false  signatures.  The  consequences  of  imperfect 
association  are  false-warning  rates  that  can  exceed  by  a  consider¬ 
able  factor  the  rates  that  would  be  obtained  assuming  perfect 
association  and  when  undesired  warnings  are  generated  in  response 
to  nonbelligerent  activities. 
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